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Abstract 

We consider two combinatorial problems. The first we call "search with wildcards": given 
an unknown n-bit string a;, and the ability to check whether any subset of the bits of x is equal 
to a provided query string, the goal is to output x. We give an optimal 0{y/n) quantum query 
algorithm for search with wildcards. Rather than using amplitude amplification or a quantum 
walk, our algorithm is ultimately based on the solution to a state discrimination problem. The 
second problem we consider is combinatorial group testing, which is the task of identifying a 
subset of k special items out of a set of n items, given the ability to make queries of the form 
"does the set S contain any special items?" for any subset S of the n items. We give a simple 
quantum algorithm which uses 0{k) queries to solve this problem, as compared with the classical 
lower bound of f2(fc log(n/fc)) queries. 



1 Introduction 

We present new quantum algorithms for two combinatorial problems. The first problem is search 
with wildcards. In this problem, we are given an n-bit string x and our task is to determine x (so 
that with probability 1 — e, all bits of x are correct) using the minimum number of queries in the 
fohowing wildcard query model. In one wildcard query, we can check correctness of any subset of 
the bits of x. That is, we identify queries with pairs {S,y), where S C [n] and y G {0, l}!'^' and the 
query returns 1 if xs = y (here the notation xs means the subset of the bits of x specified by S) . 

Wildcard queries are a generahsation of the standard quantum query model; the standard 
model corresponds to queries in which S contains just one element. Classically, each query in 
this more general model still provides only one bit of information. Hence, by an information- 
theoretic argument classical computers still require ^}{n) queries to solve search with wildcards. 
Moreover, in the standard quantum query model, identifying x with bounded error would require 
0(n) queries [15, 2]. Surprisingly, in contrast to these two lower bounds, we have the following 
theorem. 

Theorem 1. The quantum query complexity of search with wildcards is Q{^/n). 

Rather than using the usual methods of designing quantum algorithms (such as amplitude 
amplification or quantum walks), our algorithm is based on a novel information-theoretic idea. 
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Our algorithm gradually increases the information about the input string x by repeatedly using 
the Pretty Good Measurement (PGM) [3, 18] to distinguish a set of quantum states. With one 
query, we can increase the knowledge about the input x from k bits to A; + Q{\/k) bits - which 
leads to a quantum algorithm using 0(-y/n) queries. We think that this idea (and the natural state 
distinguishability problem that we solve, in Lemma 4), may be of independent interest and may 
find more applications. 

The second problem is the well known combinatorial group testing (CGT). In this problem, we 
are given oracle access to an n-bit string x such that the Hamming weight of x is equal to k. We 
usually assume that k is much smaller than n. In one query, we can get the OR of an arbitrary 
subset of the bits of x. The goal is to determine x using the minimal expected number of queries. 
This models a scenario where we would like to identify a small subset of special items out of a 
large set of items, given the ability to make queries of the form "does the set S contain any special 
items?" for any subset S of the items. 

The idea of combinatorial group testing^ dates back to 1943, when it was proposed as a means of 
identifying and rejecting syphilitic men called up for induction into the US military [11]. Following 
this seminal work, a vast literature on the subject has developed; see the textbook [12] for a detailed 
review, or the paper [23] for a discussion of more recent work. Areas to which efficient algorithms for 
CGT have been applied include molecular biology [14], data streaming algorithms [8], compressed 
sensing [9], and pattern matching in strings [7]. 

Classically, it is known that the number of queries required to solve CGT is Q{k\og{n/k)) [12]. 
The lower bound is an information-theoretic argument while the upper bound is based on binary 
search. In the quantum case, we have the following result^. 

Theorem 2. There is a quantum algorithm which solves the combinatorial group testing problem 
using 0{k) queries on average. Further, any quantum algorithm which solves CGT with hounded 
error must make Q.{\/k) queries. 

Note that our Theorem has no dependence on n (unlike the classical complexity). We prove 
Theorem 2 in two parts: a 0(fe)-query quantum algorithm in Section 2 below, and a r2(\/fe) quantum 
lower bound in Section 5. Each part of the result is fairly straightforward. 

1.1 Related work 

One can view the search with wildcards problem as oracle interrogation - i.e. learning the contents 
of an unknown bit-string x hidden in an oracle - in a non-standard oracle model. There has recently 
been some interest in this problem, in various different oracle models; we summarise the results 
which have been obtained as follows. 

• First, it was shown by van Dam [10] that in the standard oracle model (where the oracle 
performs the map i i— )> Xj), there exists a quantum algorithm which learns x with constant 
success probability using n/2+0{^/n) queries, contrasting with the n classical queries required 
to learn x. Farhi et al [16] later showed a matching n/2 + il(-^/n) lower bound. 

^CGT is sometimes simply known as "group testing" ; we prefer the inclusion of "combinatorial" to avoid confusion 
with the notion of testing a set for being a group. 

previous version of this paper claimed an upper bound of ©(v'fc polylog(fc)) queries, via a reduction to search 
with wildcards. However, the reduction was incorrect and the precise quantum query complexity of CGT remains 
open. 
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• Iwama et al have studied the quantum query complexity of counterfeit coin problems [19]. 
Here we are given a set of n coins, k of which are false (underweight), and the task is to 
determine the false coins. In this model, a query is specified by g G {0,1,-1}" such that 
Si Qi = 0- Then the oracle returns if q ■ x = 0, and 1 otherwise. We imagine that x is a 
set of coins, and Xj = if the i'th coin is fair, and Xj = 1 if the i'th coin is false. The oracle 
simulates a "quantum scale", and qi = 1 (resp. qi = —1) means that we place the i'th coin 
on the left (resp. right) pan. If the oracle returns 0, the scale is balanced, and if it returns 
1, the scale is unbalanced. Iwama et al showed that there is a quantum algorithm based on 
amplitude amplification which solves this problem using only 0{k^/^) queries, beating the 
classical information-theoretic lower bound of ^}{klog{n/k)) queries. Note that, similarly to 
our algorithm for CGT, their result removes any dependence on n from the complexity. 

• Finally, recently Cleve et al have studied oracle interrogation in the model of substring 
queries [6]. Here the allowed queries are of the form "is y a substring of x?" for y G {0, 1}^, 
1 < k < n, where a substring of x is a consecutive subsequence of x. Classically, this problem 
again requires n queries; Cleve et al proved that quantum algorithms can achieve a linear 
speedup, giving an algorithm which uses 3n/4 + o(n) queries. They also show an il(n/log^ n) 
quantum lower bound. 

1.2 Preliminaries and notation 

We write [n] := {1, 2, . . . , n}, and use |x| for the Hamming weight of x and d{x, y) for the Hamming 
distance between x and y. For x S {0, 1}", a 1-index (resp. 0-index) of x is an index i £ [n] such 
that Xj = 1 (resp. Xj = 0). For readability, we sometimes leave states unnormalised. The two 
problems that we consider are precisely defined as follows: 

• SEARCH WITH WILDCARDS. We are given oracle access to an n-bit string x (with no 
restriction on Hamming weight) and our task is to determine x using the minimum number 
of queries. A query is specified by a string s G {0, 1, *}", and returns 1 if Xj = Si for all i such 
that Si ^ *, and returns otherwise. We can equivalently identify queries with pairs {S,y), 
where S C [n] and y G {0, l}!*^' and the query Qx{S, y) returns 1 if X5 = y (here the notation 
x^ means the subset of the bits of x specified by S). In the case of quantum algorithms, we 
give the algorithm access to the unitary oracle which maps |S')|y)|2;) 1— )• |S')|y)|z © Qx{S,y)). 

• COMBINATORIAL GROUP TESTING (CGT). We are given oracle access to an n-bit string 
X such that the Hamming weight of x is at most k. We usually assume that k is much smaller 
than n. We are allowed to query arbitrary subsets S C [n] of the bits of x; a query Qx{S) 
returns 1 if there exists i € S such that Xj = 1. In the case of quantum algorithms, we give 
the algorithm access to the unitary oracle which maps \S)\z) 1— )• |S')|2: © Qx{S)). 

We note that search with wildcards is a special case of CGT. Consider an instance of CGT 
where k < n/2 and the input is divided into k blocks Bi = {2i — 1, 2i} of size 2, 1 < i < k, followed 
by a final block of n — 2k bits. The input is promised to contain exactly one 1 in each of the first 
k blocks; the position of the 1 within each block Bi encodes a bit Zj. Now consider a subset S of 
bits queried by an algorithm for CGT, and let Si = S Ci Bi. We may assume that S" is a subset of 
the first 2k bits, as the last n — 2k bits are promised to be 0. Now observe that by choosing each 
Si appropriately, we can make three different kinds of query: Si = {2i — 1} corresponds to "does 
Zi = 0?", Si = {2i} corresponds to "does Zi = 1?", and Si = {} corresponds to excluding Zi from 
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the query (the remaining query Si = {2i — 1, 2i} always returns 1 and is hence uninteresting). The 
overall query S = \J^Si is the OR of all of the individual queries. Thus a CGT query corresponds 
to a subset S of the bits of z and a claimed assignment y to these bits; the response is 1 if any of the 
bits of y are equal to z. To convert this into an instance of search with wildcards on k bits, simply 
observe that inverting the response to such a query is equivalent to performing a query (S, y) to z 
where the reply is 1 if Z5 = y. Thus an algorithm for CGT can be used to learn z and hence z. 



2 Algorithms for CGT 

We begin by considering the very special case of CGT where k = 1. Classically, this problem can 
be solved with certainty using binary search in [log2 n] queries, which is asymptotically tight by 
an information-theoretic argument. 

Lemma 3. Ifk = l, CGT can be solved exactly using one quantum query. 

Proof. The result follows from observing that, in order to learn x, it suffices to compute the function 
X ■ s for arbitrary s G {0, 1}" (this is the same observation that underpins the quantum oracle 
interrogation algorithm of van Dam [10]). In the CGT problem, we have access to an oracle which 
computes f{s) = \/^XiSi for arbitrary s E {0, 1}". But if |x| < 1, then for any s, \/^XiSi = x ■ s. 

Formally, the quantum algorithm proceeds as follows. 



1. Create the state ^^„^i X^se {o,i}nk)(|0)-|l)). 

2. Apply the oracle to create the state 

1 E (-i)V»--i.)(io)-|i)) = -i= y: (-in-)(io>-ii» 

^ se{o,i}" se{o,i}" 

3. Apply Hadamard gates to each qubit of the first register and measure to obtain x. 



Call the above algorithm the k = 1 algorithm. We can extend this idea to obtain a simple 
quantum algorithm for CGT which achieves significantly better query complexity than is possible 
classically (by not depending on n), as we now show. 

Construct a subset S C [n] by including each i G [n] with independent probability 1/k, then 
run the k = 1 algorithm on the subset of bits in S. If S contains exactly one 1-index i, which will 
occur with probability at least (1 — l/k)^~^ > 1/e, we are guaranteed to learn i. Furthermore, 
we can check whether the index i we received really is a 1-index by making one more query to 
index i. Following each successful query, we reduce /c by 1 and exclude the bit that we just learned 
from future queries. We can determine when we have learned all of the 1-indices by querying the 
complement of all the 1-indices we have learned so far. In order to learn x completely, the expected 
overall number of queries used is thus 0{k). 

We observe two further points about this simple algorithm: it is Las Vegas (i.e. it always 
succeeds eventually), and it can easily be extended to the case where k is unknown by repeatedly 
doubling a guess for k, at the cost of a multiplicative 0(logA;) factor. 
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Finally, we note (as will be important below) that the same algorithm can be used to perform 
efficient correction of bit-strings in the setting of search with wildcards. Imagine we know a bit- 
string X G {0, 1}" such that d{x,x) = k, for some unknown x G {0, 1}", where k is considered to 
be small. We are allowed to make wildcard queries to x, i.e. queries of the form (S, y) for some 
subset C [n], y G {0, 1}'"^', where the query returns 1 if and only if xs = y- Our algorithm will 
make queries of the form (S,xs) and invert the result. This will produce 1 if and only if there 
exists i £ S such that Xi 7^ Xj, or in other words {x © x)i = 1. Thus the above algorithm allows us 
to determine x (Bx and hence x using an expected 0{klogk) queries, even if k is unknown. Once 
again, this is a Las Vegas algorithm. 

3 Search with wildcards 

We now show that we can indeed solve the search with wildcards problem efficiently (proving 
Theorem 1). Consider an instance of search with wildcards of size n. Let x G {0, 1}" and k £ [n]. 

Our proof uses the following state distinguishability result (which we prove in Section 4). 
Lemma 4. Fix n > 1 and, for any < k < n, set 

\k) SC[n],\S\=k 

where \xs) ■= (Spies' Then, for any k = n — 0{^/n), there is a quantum measurement (POVM) 
which, on input iV'^i); outputs x such that the expected Hamming distance d{x,x) is 0(1). 

In words. Lemma 4 says that, given a superposition over fc-subsets of the bits of x with k = 
n — 0{y/n), we can output a bit-string that is likely to be very close to x itself. This is in sharp 
contrast to the analogous situation classically; given any n — 0{y/n) bits of x, determining the 
remaining 0{y/n) bits succeeds only with exponentially small probability. Roughly speaking, our 
algorithm for search with wildcards will repeatedly use Lemma 4 to learn 0{y/n) bits of a; at a 
time, fixing the incorrect bits after each measurement. 

Consider an instance of search with wildcards of size n. Let x € {0, 1}" and k G [n]. Recall 
that we denote 

S:SQ[n\,\S\=k 

where we write \xs) '■= ®i(zs\xi). Let M„^fc be a measurement (POVM) for distinguishing the states 
j-i/^^), and assume that Mn^k satisfies the following property: for k > n — ^/n^ and all x, the expected 
Hamming distance of the outcome x from x is upper bounded by a constant. By Lemma 4, such 
a measurement M„^fc indeed exists. We can express M^^k as a two-step process, with the ffist step 
being a unitary transformation Un,k that maps to a state in Jio ® Ti-g (where T-Lq is the output 
register and Hg is the rest of the state) and the second step being the measurement of Ho (with 
the measurement result interpreted as a guess x for the hidden bit-string x). 

We define a sequence of numbers no, . . . ,ni, with ni = n and nj_i = [nj — . Our algorithm 
consists of Stages 0, 1, . . ., I. 

Stage 0. Generate IV'"") by ffist creating X]5-5c[n] |S|=no 1*^) then querying each Xi,i G S. 

Stage s (s > 0). Stage s receives {ipx"'^) as the input and outputs iV'n^)- It consists of the 
following steps: 
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1. With no queries, transform {ipx" ^) to 

\s') Yl \s)\xs)= E i^)icr) 

S':S'C[n],\S'\=ns S:SCS' ,\S\=ns-i S:SC[n],\S\=n^ 

2. Apply Uns,ns-i on the register holding \ipxl~'^)- Use a subset query to verify whether xs in 
the Ho register is indeed equal to xs- Measure the outcome of the subset query. 

3. If the subset query answers that £5 = 3:5, we have a state 

E \S)\^s)Ws) 

S:S'^[n],\S\=ns 

where \ips) is a state in the Hg register. Apply the transformation 1 5) 1(^5) 1— )• |5')|0) (which 
requires no queries) and discard the Hg register. 

4. If the subset query answers that xs ^ xs, use the self-correction algorithm of Section 2 
(performed coherently, without measurements) to find the set of indices i such that {xs)i 7^ 
{xs)i, and update xs to xs- 

5. We now have the state 

E \S)\^s)\^s) 

S:SC[n],\S\=ns 

where \ifs) is some "garbage" state consisting of the content of Tig after Un^^us-i and leftover 
information from the subset queries in step 4. Apply the transformation \S)\ips) ^ \S)\Q) 
(which requires no queries) and discard the register holding the |0) state. 

The expected number of queries for Stage s (s > 0) is 1 for step 2 and 0{D\ogD) for step 4, 
where D is the expected number of errors in the answer xs- Since D = 0{1) by Lemma 4, the 
expected number of queries is 0(1). 

For the number of stages, we can choose / = 0{y/n) so that no = 0{y/n). Then, the algorithm 
uses no = 0{^/n) queries in Stage and expected 0(1) queries in each of the next 0{^/n) stages. 
Hence, the expected total number of queries is 0(-^/n). 

4 The state discrimination problem 

Our final task is to prove Lemma 4, i.e. to show that, given the state 

\^')--=^2 E 1^)1-^)' 

\k) SQ[n],\S\=k 

for any k = n — 0{y/n), we can output x such that the expected Hamming distance between x 
and X is constant. We will achieve this using the pretty good measurement [3, 18] (PGM), which 
is also known as the square root measurement [13] and is defined as follows. Given a set {| 
of pure states, set p = |(/>i)((/)j|. Then the measurement vector corresponding to state \4>i) is 
:= p^^^'^\<pi), the inverse being taken on the support of p. This is a valid POVM because 

i X \ i / 
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The probability that the PGM outputs j on input |(/>j) is precisely where G is the Gram 

matrix of the states Gij = {(t)i\4>j). In our case, we have 

1 (n-d{x,y)\ 

G.y = = jns E i^s = ys]=^ ' ' 



^k) 5C[n],|5|=fc 



it) 



As Gxy depends only on a;©y, G is diagonalised by the Fourier transform over Z2 . Eigenvalues A(,s) 
of G, indexed by bit-strings s G {0, l}*^, are thus given by the Fourier transform of the function 

tn-\x\\ 

f{x) = Gxo = f'^\ ■ Indeed, we have 

xG{o,i}" ^i'^ xe{o,i}" ^ ^ ^f'' 

where the final equality is an identity of Delsarte [20, Eq. (48)]. 

As VGxy also depends only on x © y, the expected Hamming distance of the output y from the 
input X does not depend on x and is equal to 

Dk:= Yl dix,y)iVGxyf = \y\iVGoyf. 

y6{0,l}" ?/e{0,l}" 

We now proceed to upper bound this quantity using Fourier duality. Observe that Dk can be 
viewed as the inner product between the functions f{x) = \x\ and g{x) = ("v/GoxO^- -^^y Plancherel's 
theorem we have 

f{x)g{x) = 2- Y f{s)g{s), 
xe{o,i}" s6{o,i}" 

where for any function / we define /(s) = 1^ Ylxe{o fi^)- easily calculate that 

' n 

f{s) 



(1 if s = 0" 

-5 if|s| = l 
otherwise. 



On the other hand, we can compute the Fourier spectrum of g as follows. As the Fourier transform 
turns multiplication into convolution, we have 

We can therefore determine the Fourier spectrum of g directly from that of the function ^/g{x) = 
VGqx- We have already computed this Fourier transform; up to normalisation, it is just the function 
giving the eigenvalues of VG, or in other words the function \/l\(s). We thus obtain 



'^'^ = ^ [n-k [ n-k J 
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This is a fairly complicated expression, but as f{s) =0 when \s\ > 1, we only need to calculate a 
few special cases. In particular, we have 5(0") = 1/2" and 

^^^^^ = irSU-^J [[t-l)[ n-k ) +U Jl n-k 



n 

■,—n—k 



n 

E 



t/ynV^ — i+l/ V n J \n — t 

k 



for bit-strings ej of Hamming weight 1. Thus 2"^(ej) is equal to 1 when k = n and will be close 
to 1 when k is close to n. Indeed, set k = n — C\/n and consider terms Tt in this sum such that 
t = n/2 + Qy/n, for a G M. Then, using the lower bound ^/x > l^; — ^x^, which is valid for x > 0, 
we have 



2 ^/nJ \ y^/2 — (a + c) + l/-v/ny \2 ^/n J \ ^Jnl2 — a 

, 1 a \ / c /I a ^ / - ^ 

> - + ^ 1 + ^7:^ + 



2 7 V \/n/2 — ay \2 7 V \/nl2 — a 



1 / c \ ^ ac 
> 1-- — + 



2 \^/n/2 — a) A/n(-y/n/2 — a) 
= l-0(l/n) 

for constant a and c. We thus have 2"'g{ei) > 1 — 0(l/n). Computing the inner product 
2"Ese{o,i}" f{s)9{s), we get 

77 

A, = -(l-9(e.)) = 0(l) 

as desired. In Appendix A, we continue the analysis of the state discrimination problem by giving 
quite tight upper and lower bounds on the probability of identifying x exactly. 



5 A matching lower bound 

We finally prove that our results for the search with wildcards problem are optimal. We will use 
the following very general "strong weighted adversary" bound formulated by Zhang [25] (for the 
statement given here, see [6, 24]). 

Theorem 5. Let f : S ^ T be a function and let Q be a finite set of possible query strings. 
Let X G S be an initially unknown input which is accessed via an oracle Ox performing the map 
Ox\q)\z) = \q)\z(B Ci^^ where q £ Q, z £ {0,1}, and ( : S x Q ^ {0,1} is a function specifying 
the response to oracle queries. Also let w, w' be weight schemes such that: 

• Each pair {x,y) € S x S is assigned a non-negative weight w{x,y) = w{y,x) such that 
w{x,y) = whenever f{x) = f{y); 

• Each triple {x,y,q) G S x S x Q is assigned a non-negative weight w'{x,y,q) such that 
w'{x, y,q) =0 for all x, y, q such that C(x, q) = C{y, q) or f{x) = f{y), and w'{x, y, q)w'{y, x, q) > 
w{x,y)^ for all x, y, q such that C{x,q) ^ C{y,q) and f{x) / f{y). 
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For all X ^ S and q £ Q, set wt{x) = Yly^i^^v) ^^'^ v{x,q) = 'YliyW'{x,y,q). Then any quantum 
query algorithm that computes f{x) with success probability at least 2/3 on every input x must make 



^ niin / wt{x)wt{y) 

x,y,q;w{x,y)>0, V v{x, q)v{y, q) 
V C(^,<?)/C(2/,'?) 



queries to the oracle Ox- 



Lemma 6. Any quantum algorithm which solves search with wildcards on n bits with worst-case 
success probability 2/3 must make il(-y/n) oracle queries. 

Proof. In the seach with wildcards problem the input is a string x G {0, 1}", queries q = {S,t) are 
specified by 5 C [n], t G {0, 1}''^', and C{x,q) = 1 if and only if xs = t. We define the following 
weight scheme: w{x,y) = 1 if d{x,y) = 1, and w{x,y) = otherwise; w'{x,y,q) = w'{y,x,q) = 1 if 
d{x,y) = 1 and C{x,q) 7^ C(yi'?)i ^-nd w'{x,y,q) = w'{y,x,q) = otherwise. For any x G {0,1}", 
wt(j;) = n. On the other hand, 



v{x, q) = \{y: d{x, y) = 1, C(a;, q) ^ Civ, <l)}\ 



i\S\ [ax,q) = l] 
1 [C{x,q)=0,d{xs,t) = l] 
[otherwise] 



Hence 



/ wt(x)wt(y) 
mm \ / — \! Tx 

y,g;wix,y)>0\ v{x,q)v{y,q) 



and the claim follows from Theorem 5. □ 

Via the reduction from search with wildcards to CGT, Lemma 6 implies that CGT requires 
quantum queries, completing the proof of Theorem 2. 



6 Outlook 

The major open question left by our work is to fully resolve the quantum query complexity of CGT. 
A previous version of this paper incorrectly claimed a 0(\/A;polylog(A:)) algorithm for this problem; 
it is a very interesting open problem to determine its true complexity. 

An alternative way of considering the CGT problem is as a restricted case of the problem of 
learning juntas via membership queries [22, 1]. A fc-junta is a boolean function that depends only 
on at most k input bits. The general problem of learning juntas is defined as follows. Given 
oracle access to a function / : {0,1}" — {0,1}, and the promise that / is a fc-junta, output a 
representation of / (e.g. its truth table). It is easy to see that CGT is the special case of this 
problem where / is restricted to be the OR of k of the input bits; our algorithm therefore allows 
this restricted problem to be solved using 0{k) queries. The same algorithm also works if / is 
promised to be an AND function (i.e. f{x) = /\^^gXi, for some S such that \S\ = k), because 
in this case querying f{x) and negating the output simulates a query to a function /' such that 
f'{x) = Vigs^j- It would be interesting to determine whether efficient quantum algorithms could 
be found for other restricted cases of the junta learning problem. 
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A related question is testing juntas. In this problem we are given a function / : {0, 1}" — )• {0, 1} 
such that / either is a A; -junta, or differs from any fc-junta on at least e2"' inputs, and must determine 
which is the case. Classically, this problem can be solved using 0{k/e + A; log A:) queries [4], while 
there is an Q,{k) lower bound on the number of queries required [5]. In the quantum case, Atici 
and Servedio have given an 0(A;/e)-query algorithm [1]. It has recently been observed that there 
are connections between the junta testing problem and CGT [17]. It would be very interesting if 
our results could be used or generalised to give an 0(\/fc polylog(A;)) quantum algorithm for testing 
juntas. 
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A Further analysis of the state discrimination problem 

In this appendix, we carry out some further analysis of the problem of discriminating the states 
1-0^) discussed in Section 4. We have the bound from [21] that 

which allows us to prove the following lower bound on the probability that the PGM outputs x 
exactly. 

Lemma 7. Set k = n — a^Jn for some < a < 1. Then {VCxx)"^ > 1 — 2a^ — 0{l/^/n). 



Proof. By (2) we have 



2 



(y/G )^ > Vfc/' ^ (fc) 

I XX ) - (n\(d\'^ V" (d\/n-k\- 

l^d=0 U [k) ^d=0 \k) \d-k) 



We now upper bound the reciprocal of this quantity, setting g = n — k, i = n — d to obtain 
^ - g + i\ f g\ _ 1 [n - g\ ( g\{n - g + i) . . .{n - g + 1) 



1^/ \/\/ -x / 



(") ^-^ \ i 7\V\ "IT- ~ 9 J \ n — g — i + 1 

< g3(9+l)/(n-29+l) 

< l + 2a'^ + 0{l/^/n). 



□ 
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We also record here an exact expression for the probabihty of getting outcome y on input x. 
Let KJ^{x) be the fc'th Krawtchouk polynomial [20], defined by 



Lemma 8. 




Proof. Essentially immediate from the discussion in Section 4; the entries of ^/G can be calculated 
using 

1 1 / _ I l\ 1/2 

se{o,i}" " [kJ se{o,i}" ^ ^ 




where A(s) are the eigenvalues of G (see eqn. (1)). Lemma 8 then follows using well-known identities 
for binomial coefficients and Krawtchouk polynomials [20]. □ 

We finally turn to putting upper bounds on how well x can be identified given a state of the 
form We first observe that there is no loss of generality in putting upper bounds on the 

success probability of the PGM, as it is in fact the optimal measurement for identifying x (in terms 
of minimising the average probability of error). This follows from a result of Eldar and Forney [13] 
which shows that the PGM minimises the probability of error of state discrimination for states 
which are geometrically uniform, i.e. generated by applying an abelian group to an initial state \(p). 
This holds for our states, as they can be thought of as being generated by applying the unitary Uy 
defined by Uy\S)\x) = \S)\x + ys) to the initial state T.sc[n],\s\=k The set {Uy}, y E {0, 1}", 
clearly forms an abelian group. As a more concise proof, optimality of the PGM follows directly 
from the diagonal entries of \/G being equal [3]. 

Lemma 9. Set k = n — a\/n for some a > 0. Then 

(^/G..)2 < 4e-'^V32. 



Proof. We have 



2-{n+k)/2 ^ 

2=0 



1/2 



1/2 
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Now split the sum into two parts to obtain 

1/2 / \ 1/2 



z<k/2+aVk/4 ~ • <^ ■ rr,. 



z>k/2+a\/k/A 



< 



\ z<\\'i^ 



I 



1/2 



( 



on jL^ 



2 4 



1/2 



+ 



v 



2 4 



1/2 



1/2 



2^ X/ (7)1 9™ E 



fc I a\/fc 
2 4 



by Cauchy-Schwarz. We now use the Chernoff bound that 



)n H (^) - 



-62/2 



2>n/2+6v'n 



for any 6 > 0, which imphes 



-oV32 



z<k/2+a^/k/4 z>k/2+a\fkH 

noting that k/2 + aVk/A: <n/2 — ay/n/A by assumption. The claimed upper bound follows. □ 
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